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This is in response to the appeal brief filed 08 December 2008 appealing from 
the Office action mailed 15 July 2008. 



Application/Control Number: 10/673,812 Page 2 
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(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or judicial 
proceedings which will directly affect or be directly affected by or have a bearing on the 
Board's decision in the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 

No amendment after final has been filed. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on appeal is 
correct. 
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(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(8) Evidence Relied Upon 

e-business Cookbook for z/OS Volume I. Technology Introduction Vilaghy et al. 
July, 2002 

6728769 Hoffman JUN 2000 

200401 07282 Chakraborty et al. DEC 2002 

6598167 Devine et al. SEP 1998 

6510523 Perlmanetal. FEB 1999 

20020138761 Kanemaki et al. SEP 2002 

(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 

Claims 1 and 8-9 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Vilaghy et al. ("e-business Cookbook for z/OS Volume I. Technology Introduction"). 

Consider claims 1 , 8, and 9. Vilaghy et al. discloses a relay processing apparatus 
for relaying communications between a control program that generates control 
commands for a terminal and a process for an HTTP server program that returns to said 
terminal a command constituting an HTTP response to a HTTP request received from 
said terminal, comprising: a terminal request processor for initiating said control 
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program upon the reception of a function call from said HTTP server program that 
initially received said HTTP request from the terminal (("Web component tier. This tier 
gets client requests (HTTP.HTTPS), analyzes the requests and decides to respond with 
a file (HTML, images) or calls a program (servlet) to do some part of the server-side 
processing requested by the client. Generally the servlet acts as the Controller (controls 
the whole application flow), then calls a JavaServer Page (JSP) to dynamically generate 
the HTML response (the presentation or View) to be sent back to the client.") page 23); 
means in the terminal request processor responsive to the reception notification, for 
returning the first command to said HTTP server program, and means in the HTTP 
server program for returning said command to the terminal in said HTTP response 
issued for said HTTP request (("The response created by the servlet is passed back to 
the HTTP server. The HTTP server passes back the response produced by the servlet 
to the client. If the client is a browser, the response will contain HTML formatted data.") 
page 124). However, the Web component tier fails to disclose an HTTP server receiving 
an HTTP request or a control request processor for receiving from said control program 
a first command generated as a response to the function call, and for transmitting to 
said terminal request processor a notification that said first command has been 
received. Vilaghy et al. further discloses a CICS Webserver Plugin wherein an HTTP 
Server receives the HTTP request (("The CICS Webserver Plugin replaces the 
functionality of the CWS Web attach transaction, described previously. The IBM HTTP 
Server for z/OS has to be configured with a service directive in order to function with the 
CICS Webserver Plugin. This configuration is described in the CICS Internet Guide, 
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SC34-5713. Using this service directive, the HTTP Server receives the HTTP request, 
builds an EXCI request, and invokes the BLI using the CSMI mirror transaction in the 
target CICS region. The HTTP data stream is passed to the BLI in an EXCI 
COMMAREA.") page 154). and a control request processor for receiving from said 
control program a first command generated as a response to the function call, and for 
transmitting to said terminal request processor a notification that said first command has 
been received (("WebSphere manages and runs servlets and JSPs that contain the 
presentation logic to format the data coming from the back-end systems. WebSphere 
will provide a container to run Enterprise Java Beans (EJBs). This container provides 
transactional and other services. The servlets or JSPs invoke the EJBs. The EJBs 
contain the new, transactional business logic, and the servlets/JSPs should only contain 
presentation logic. The EJBs can connect to back-end systems using connectors.") 
page 67). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to incorporate a CICS Webserver Plugin wherein an 
HTTP Server receives the HTTP request and servlets and JSPs that contain the 
presentation logic to format the data coming from the back-end systems as taught by 
Vilaghy et al. with a Web component tier that gets client requests (HTTP,HTTPS), 
analyzes the requests and decides to respond with a file (HTML, images) or calls a 
program (servlet) to do some part of the server-side processing requested by the client 
and a response created by a servlet is passed back to an HTTP server and the HTTP 
server passes back the response produced by the servlet to the client, and if the client 
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is a browser, the response will contain HTML formatted data as taught by Vilaghy et al. 
for the purpose of a relay processing apparatus wherein an HTTP client can 
communicate with a back-end application. 

Claim 2 is rejected under 35 U.S.C. 103(a) as being unpatentable over Vilaghy et 
al. ("e-business Cookbook for z/OS Volume I. Technology Introduction") in view of 
Hoffman (US 6728769 B1). 

Regarding claim 2, and as applied to claim 1 above. Vilaghy et al. shows and 
discloses a relay processing apparatus comprising means in the control request 
processor (figure 13-8, page 162) for transmitting the results from the first command to 
the control program, and means in the control program for performing a process 
corresponding to said results from the first command (("Aside from just formatting the 
output, servlets (read as control program) might need to talk to EJBs (read as request 
processor) to get data from databases or invoke transactions.") page 125). However, 
Vilaghy et al. fails to disclose means in the terminal for transmitting to the HTTP server 
program a second HTTP request that includes results from the first command. Hoffman 
discloses sending a second HTTP request that includes a flag indicating that an update 
has been successful (("Once the appropriate data has been received by the JSP 242, 
the JSP 242 directs that that WEB server 204 update the server-side data base 208 
according to the selected input. In response, the WEB server 204 sends an HTTP 
response to the applet 228 by way of the JSP 242 directing the browser 214 to update 
only an update icon 244 indicating that the server side database 208 has been 
successfully updated. In this way, the user experiences a substantially real time 
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interaction since the update icon immediately reflects the effects of the user supplied 
input data on the data base 208 without the need to refresh the entire, or even a 
substantial portion of the WEB page.") column 5 lines 60-67 and column 6 lines 1-4 ("... 
generating a second http request by the http request generator, wherein the second http 
request includes a database update successful flag indicating that the database has 
been successfully updated; sending the second http request interaction applet; and 
updating the update icon only by the interaction applet indicating that the database has 
been successfully updated. ") claim 1). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to incorporate sending a second HTTP request indicating 
a successful update as taught by Hoffman with a means for sending a command and 
performing a process as taught by Vilaghy et al. for the purpose of application 
verification. 

Claims 3-4 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Vilaghy et al. (" e-business Cookbook for z/OS Volume I. Technology Introduction" ) in 

view of Chakraborty et al. (US 200401 07282 A1 ). 

Consider claims 3 and 4, and as applied to claim 1 above. Vilaghy et al. 
discloses means responsive to a program for shifting a processor into a halted state 
while maintaining an execution state after a function; and means responsive to a 
notification from a processor for recovering from said halted state (("According to normal 
component-to-component communication, calls happen synchronously. This means that 
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a component calls another component using the RMI-IIOP procedure, and during the 
call the client or caller waits till the server or the called party finishes.") page 1 38) and 
returning processing control and the first command to said HTTP server program (("5. 
The response created by the servlet is then passed back to the HTTP server.") page 
124). However, Vilaghy et al. fails to disclose a means responsive to a following second 
function call from the HTTP server program. Chakraborty et al. discloses a method for 
preserving post data on a server system wherein once a user has authenticated with 
correct credentials (such as a login and password), the request goes back to the 
browser from where the user submitted the request, and an agent intercepts the request 
through a server application function for a second time (("FIG. 5B is a diagram 
illustrating an exemplary communication pathway between a browser, an agent and an 
identity server during a GET request and authentication in accordance with an 
embodiment of the present invention. The browser (C) communicates with an 
authentication server to authenticate the user in step 512. In one embodiment of the 
present invention, the authentication server is a Sun One identity server. Once a user 
has authenticated with the correct credentials (such as a login and password), the 
request goes back to the browser from where the user submitted the request. The agent 
intercepts the request through a server application function (SAF) for the second time.") 
paragraph 0051). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to incorporate a method for preserving post data on a 
server system wherein once a user has authenticated with correct credentials (such as 
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a login and password), the request goes back to the browser from where the user 
submitted the request, and an agent intercepts the request through a server application 
function for a second time as taught by Chakraborty et al. with means responsive to a 
program for shifting a processor into a halted state while maintaining an execution state 
after a function; and means responsive to a notification from a processor for recovering 
from said halted state and returning processing control and the first command to said 
HTTP server program as taught by Vilaghy et al. for the purpose of secure 
authentication. 

Claim 5 is rejected under 35 U.S.C. 103(a) as being unpatentable over Vilaghy et 
al. ("e-business Cookbook for z/OS Volume I. Technology Introduction") in view of 
Devineetal. (US 6598167 B2). 

Regarding claim 5, and as applied to claim 1 above. Vilaghy et al. shows and 
discloses a relay processing apparatus wherein an HTTP failure response message is 
sent to the terminal (("The login-config element specifies the type of authentication to be 
used and any associated data, such as login and error pages for form-based 
authentication.") page 84). However, Vilaghy et al. fails to disclose a terminal request 
processor comprising means responsive to a non-receipt of said reception notification 
from said control request processor within a predetermined period of time. Devine et al. 
discloses monitoring heartbeats for a predetermined period of time and determining a 
process to be closed if the heartbeats fail to respond (("For example, a keep alive 
message is sent every predefined period, e.g., 1 minute from a client application to the 
server. When the client application fails to heartbeat consecutively for a predetermined 
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period of time, for example, one hour, the server treats this client application as having 
exited by closing the application and performing cleanup routines associated with the 
application.") column 4 lines 1-7). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to incorporate monitoring heartbeats for a predetermined 
period of time as taught by Devine et al. with error pages as taught by Vilaghy et al. for 
the purpose of event notification. 

Claim 6 is rejected under 35 U.S.C. 103(a) as being unpatentable over Vilaghy et 
al. ("e-business Cookbook for z/OS Volume I. Technology Introduction") in view of 
Perlmanetal. (US 6510523 B1). 

Regarding claim 6, and as applied to claim 1 above. Vilaghy et al. shows and 
discloses a relay processing apparatus according to claim 1 . However, Vilaghy et al. 
fails to disclose a certification request message for requesting the preparation of an 
electronic certificate that authenticates a terminal in accordance with a command 
received from a control program. Perlman et al. discloses a system wherein certificates 
are requested from a device, generated, and granted. This reads on the claimed 
"requesting the preparation of an electronic certificate that authenticates said terminal 
... in accordance with a command received from said control program ... means to 
transmit a signature addition command to said terminal containing an electronic 
signature." (("Credentials server 120 is a device (e.g., server) connected to network 
150 that is capable of generating credentials (e.g., a private key and a public key 
certificate) trusted by one or more remote terminals. Credentials server 120 issues 
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credentials to a user to permit privileged operations. These credentials typically include 
public key certificates.") column 4 lines 38-44 ("Having established a secure 
communications channel, the user communicates with credentials server 120 using the 
untrusted terminal. In one implementation, the user can request credentials, such as a 
private key and a public key certificate, from credentials server 120, with which the user 
is registered. Both the private key and the public key may be represented as an 
alphabetic or numeric record (e.g., a 64-bit number). Although the private key is kept 
secret, the public key may be published. In another implementation, the private and 
public keys can be generated by the untrusted terminal. In this instance, the public key 
is sent to credentials server 120 so that it can generate a certificate for this key... In 
many public key systems, public keys are verified and access is granted based on a 
chain of certificates. With such systems, the credentials might include one or more 
certificates that complete such a chain. For instance, the credentials may include a 
chain of identity certificates to establish the name associated with a given public key. In 
addition, the credentials may include one or more delegation certificates delegating 
privileges associated with one key to another key. For instance, the user may sign a 
delegation certificate for the credentials server, which may sign a delegation certificate 
for the untrusted terminal. Either or both of these delegation certificates may include 
limited privileges. Alternatively, the credentials server might have a copy of the user's 
private key and use this to directly sign a delegation certificate for the untrusted 
terminal.") column 5 lines 55-67 and column 6 lines 1-17). 



Application/Control Number: 10/673,812 Page 12 

Art Unit: 2443 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to incorporate generating an identity certificate as taught 
by Perlman et al. with a means for sending a command and performing a process as 
taught by Vilaghy et al. for the purpose of secure authentication. 

Claim 7 is rejected under 35 U.S.C. 103(a) as being unpatentable over Vilaghy et 
al. ("e-business Cookbook for z/OS Volume I. Technology Introduction") in view of 
Perlman et al. (US 651 0523 B1 ) and in further view of Kanemaki et al. (US 
20020138761 A1). 

Regarding claim 7, and as applied to claim 6 above. Vilaghy et al., as modified by 
Perlman et al., shows and discloses an apparatus of claim 6, comprising an information 
storage unit (("Storing your e-business files on high performance storage can alleviate 
I/O bottlenecks that exist on other platforms") Vilaghy et al., page 47 and Figure 3-2). 
However, Vilaghy et al., as modified by Perlman et al., fails to disclose an apparatus of 
claim 6, wherein the terminal request processor further comprises means for receiving a 
second function call containing a certification request message and an electronic 
signature from said HTTP server program as a response by the terminal to said 
signature addition command, and means for forwarding a notification to that effect to 
said control request processor; means in the control request processor responsive to 
the notification of receipt of the second function call for transmitting said certification 
request message to said control program; and means in said terminal request processor 
for transmitting an electronic certificate received from said control program. Kanemaki et 
al. discloses an authentication system wherein a second transaction (function call) is 
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made upon receiving results of signature information after first transaction (("... 
authentication apparatus holding information relating to a first transactor and 
authenticating a transaction between said first transactor and a second transactor 
performed via a network while communicating with another authentication apparatus 
holding information relating to said second transactor, comprising a transmitting and 
receiving means for transmitting a second request including information specifying said 
second transactor in response to a first request from said first transactor including 
information indicating said transaction content and information specifying said second 
transactor to said second authentication apparatus, receiving first signature information 
indicating an authentication result by said second authentication apparatus in response 
to said second request, transmitting a third request including information relating to said 
transaction content included in said first request and said first signature information to 
an apparatus used by said second transactor, and receiving a predetermined reply from 
an apparatus used by said second transactor in response to the related third request, a 
storage means for storing a log of said transaction when receiving said predetermined 
reply, and a signature producing means for producing second signature information to 
be transmitted to the apparatus used by said first transactor via said transmitting and 
receiving means when receiving said predetermined reply and indicating the 
authentication result of the legitimacy of said transaction.") paragraph 0050). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to incorporate a second certification request and an 
electronic signature as taught by with a means for sending a command and performing 
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a process as taught as taught by Vilaghy, as modified by Perlman et al., for the purpose 
of secure authentication using digital certificates. 

(10) Response to Argument 

The Examiner summarizes the various points raised by the Appellants and 
addresses replies individually. 

Applicant's Representative asserts that the client browser is described and 
illustrated throughout Vilaghy, e.g., in Fig. 10-3. Referring to Fig. 2-8 on pq. 22, which 
illustrates a servlet (allegedly corresponding to the claimed "control program") within a 
web container and to Fig. 10-3 on pg 133, which also illustrates a servlet (allegedly 
corresponding to the claimed "control request processor"), these separate references to 
"servlets" by the Examiner appear to be the same teaching. Thus, the Examiner is 
reiving upon the same teaching within Vilaghy to teach the claimed "control program" 
and "control request processor." 

The Examiner respectfully disagrees. The control request processor of the 
Application is read as an EJB container in the reference, not a servlet, as Applicant's 
Representative alleges. The control program of the Application is read as a web 
container in the reference, not a servlet, as the Applicant's Representative alleges. 
Vilaghy et al. discloses a relay processing apparatus for relaying communications 
between a web container (read as a control program) that generates control commands 
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for a terminal and a process for an HTTP server program that returns to said terminal a 
command constituting an HTTP response to a HTTP request received from said 
terminal, comprising: a terminal request processor for initiating said control program 
upon the reception of a function call from said HTTP server program that initially 
received said HTTP request from the terminal (page 23); and an EJB container (read as 
a control request processor) for receiving from said control program a first command 
generated as a response to the function call, and for transmitting to said terminal 
request processor a notification that said first command has been received (page 67). 

Applicant's Representative asserts that as claimed, the control request processor 
receives, from the control program, a first command generated as a response to the 
function call. However, since the Examiner is reiving upon the same teaching (i.e., 
servlet) within Vilaghy to teach the claimed "control program" and "control request 
processor," Appellants are unclear as to how the Examiner can characterize Vilaghv as 
teaching both of these limitations. 

The Examiner respectfully disagrees. The control request processor of the 
Application is read as an EJB container in the reference, not a servlet, as Applicant's 
Representative alleges. The control program of the Application is read as a web 
container in the reference, not a servlet, as the Applicant's Representative alleges. 
Vilaghy et al. discloses a relay processing apparatus for relaying communications 
between a web container (read as a control program) that generates control commands 
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for a terminal and a process for an HTTP server program that returns to said terminal a 
command constituting an HTTP response to a HTTP request received from said 
terminal, comprising: a terminal request processor for initiating said control program 
upon the reception of a function call from said HTTP server program that initially 
received said HTTP request from the terminal (page 23); and an EJB container (read as 
a control request processor) for receiving from said control program a first command 
generated as a response to the function call, and for transmitting to said terminal 
request processor a notification that said first command has been received (page 67). 

Applicant's Representative asserts that with regard to the claimed "notification 
(S350) that said first command has been received," the Examiner identified, as allegedly 
teachings these limitations, a teaching within Vilaqhv of "a notification mechanism 
between JavaBeans to announce that something has happened." As also claimed, the 
control request processor (allegedly disclosed by the servlets) transmits the notification 
to the terminal request processor (allegedly disclosed by the web container). However, 
referring to Fig. 2-8, an Enterprise Bean (i.e.. a JavaBean) is found within the EJB 
(Enterprise JavaBean) Container. Referring to Fig. 2-9 and 10-3, the EJB Container is a 
separate entity from either the web container (allegedly teaching the terminal request 
processor) or the servlets (allegedly teaching the control request processor). Thus, the 
Examiner has further mischaracterized the scope and content of Vilaghv. 

The Examiner respectfully disagrees. The control request processor of the 
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Application is read as an EJB container in the reference, not a servlet, as Applicant's 
Representative alleges. The terminal request processor of the Application is read as a 
Webserver Plugin in the reference, not a web container, as Applicant's Representative 
alleges. Vilaghy et al. discloses an EJB container (read as a control request processor) 
for receiving from said control program a first command generated as a response to the 
function call, and for transmitting to said terminal request processor a notification that 
said first command has been received (page 67), and means in the web server plugin 
(read as a terminal request processor) responsive to the reception notification, for 
returning the first command to said HTTP server program, and means in the HTTP 
server program for returning said command to the terminal in said HTTP response 
issued for said HTTP request (pages 124 and 154). As for Vilghy et al. Figures 2-8, 2- 
9, and 10-3 of Applicant's Representative arguments, these Figures were never cited. 

Applicant's Representative asserts that the statement of the rejection found on 
pages 2-13 of the Third Office Action is substantially identical with the statement of the 
rejection on pages 2-17 of the Second Office Action. Referring to pages 3-5 of the Third 
Office Action, the Examiner only refers to Vilaghy in three instances within the 
statement of the rejection - (1 ) on line 5 of page 3: (2) on line 5 of page 4: and (3) on 
line 5 of page 5. However, in none of these instances does the Examiner ascertain the 
differences between the prior art (i.e., Vilaghy) and the claims at issue. 

Vilaghy et al. discloses a relay processing apparatus for relaying communications 
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between a web container (read as a control program) that generates control commands 
for a terminal and a process for an HTTP server program that returns to said terminal a 
command constituting an HTTP response to a HTTP request received from said 
terminal, comprising: a terminal request processor for initiating said control program 
upon the reception of a function call from said HTTP server program that initially 
received said HTTP request from the terminal (page 23); and an EJB container (read as 
a control request processor) for receiving from said control program a first command 
generated as a response to the function call, and for transmitting to said terminal 
request processor a notification that said first command has been received (page 67) , 
and means in the web server plugin (read as a terminal request processor) responsive 
to the reception notification, for returning the first command to said HTTP server 
program, and means in the HTTP server program for returning said command to the 
terminal in said HTTP response issued for said HTTP request (pages 124 and 154). 

Applicant's Representative asserts that the Examiner has rejected the claims 
under 35 U.S.C. § 103 so Appellants presume that the Examiner believes that Vilaahv 
does not identically disclose all of the claimed limitations. However, the Examiner fails 
to identify those limitations that Vilaqhv fails to teach. Thus, the Examiner has failed to 
properly ascertain the differences between Vilaqhv and the claims at issue, which is one 
of the Graham findings of fact that must be made bv the Examiner. 

Vilaghy et al. discloses a relay processing apparatus for relaying communications 
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between a web container (read as a control program) that generates control commands 
for a terminal and a process for an HTTP server program that returns to said terminal a 
command constituting an HTTP response to a HTTP request received from said 
terminal, comprising: a terminal request processor for initiating said control program 
upon the reception of a function call from said HTTP server program that initially 
received said HTTP request from the terminal (page 23); and an EJB container (read as 
a control request processor) for receiving from said control program a first command 
generated as a response to the function call, and for transmitting to said terminal 
request processor a notification that said first command has been received (page 67) , 
and means in the web server plugin (read as a terminal request processor) responsive 
to the reception notification, for returning the first command to said HTTP server 
program, and means in the HTTP server program for returning said command to the 
terminal in said HTTP response issued for said HTTP request (pages 124 and 154). 

Applicant's Representative asserts that for the first full paragraph on page 5 of 
the Third Office Action, Appellants are entirely unclear as to the relevance of these 
assertions. The Examiner does not refer to the actual language of the claims. Moreover, 
the Examiner does not precisely describe what would be the alleged modification to the 
teachings of Vilaghv. 



Vilaghy et al. discloses a relay processing apparatus for relaying communications 
between a web container (read as a control program) that generates control commands 
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for a terminal and a process for an HTTP server program that returns to said terminal a 
command constituting an HTTP response to a HTTP request received from said 
terminal, comprising: a terminal request processor for initiating said control program 
upon the reception of a function call from said HTTP server program that initially 
received said HTTP request from the terminal (page 23); and an EJB container (read as 
a control request processor) for receiving from said control program a first command 
generated as a response to the function call, and for transmitting to said terminal 
request processor a notification that said first command has been received (page 67) , 
and means in the web server plugin (read as a terminal request processor) responsive 
to the reception notification, for returning the first command to said HTTP server 
program, and means in the HTTP server program for returning said command to the 
terminal in said HTTP response issued for said HTTP request (pages 124 and 154). 
Though found in different embodiments of the Vilaghy et al. reference, they are all from 
the same invention and would have been obvious to combine for the purpose of passing 
web pages from a backend server to a terminal via a secure gateway. 

(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the Examiner in the 
Related Appeals and Interferences section of this Examiner's Answer. 

For the above reasons, it is believed that the rejections should be sustained. 
Respectfully submitted, 
Mark D. Fearer 
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